The Need for Secure Identification

NOTE: As shown by the comments, this subject is controversial. The opponents are many (actually there are eighteen states). Among the objections is the high cost pass through to the states of the mandated changes in drivers’ licenses as defined in the Real ID Act of 2005. Also, civil liberties supporters claim that privacy is violated by various requirements for biometric information being embedded in the new IDs, as well fearing that a Real ID is a precursor of a National ID card. Yet, despite all of the objections, a key question remains. How do we ensure that a person presenting an ID is not only the person for whom the ID was initially issued, but also whether the ID document itself is authentic.

The “final rule” released by the Department of Homeland Security on January 11th reduced the pass through costs by 73%. The DHS announcement also included:

"The American public's desire for greater identity protection is undeniable," said Homeland Security Secretary Michael Chertoff. "Americans understand today that the 9/11 hijackers obtained 30 drivers licenses and ID's, and used 364 aliases. For an extra $8 per license, REAL ID will give law enforcement and security officials a powerful advantage against falsified documents, and it will bring some peace of mind to citizens wanting to protect their identity from theft by a criminal or illegal alien."

While opponents argue that the Real ID Act was passed as an amendment to a Defense Department Appropriations bill, Congress passed the Act in an attempt to address some of the findings of the September 11 Commission. When you look at the events of September 11th that raised everyone’s attention to issues of security, it is hard to lend too much credence to the opponents’ issues when balanced against issues of security. While the following is admittedly from an editorial written by Secretary Michael Chertoff in the Houston Chronicle the facts remain:

● All but one of the 9/11 hijackers carried government IDs that helped them board planes and remain in the country illegally.

● Last year, our immigration and customs agents charged hundreds of illegal workers with crimes relating to state and federal document fraud.

Even though some people argue that some of the hijackers carried legal drivers licenses, those people fail to understand that there are serious holes in security, especially when it comes to the authenticity of the so-called “breeder documents” (like birth certificates and social security cards) that people have used in the past to secure (I should actually use the word, “obtain”), a legal drivers license.

As a result, one of the important provisions of the recently “Final Rule” of the Real ID Act issued by the Department of Homeland Security (at least in my opinion) is that it will :

"...establish minimum standards for state-issued driver’s licenses and identification cards in accordance with the REAL ID Act of 2005. These regulations set standards for states to meet the requirements of the REAL ID Act," including:

● information and security features that must be incorporated into each card;
● proof of identity and U.S. citizenship or legal status of an applicant;
● verification of the source documents provided by an applicant; and
● security standards for the offices that issue licenses and identification cards.

This final rule also provides a process for States to seek an additional extension of the compliance deadline to May 11, 2011, by demonstrating material compliance with the core requirements of the Act and this rule.

Minimum Standards for Drivers Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes: Final Rule

Based on the Final Rule, the Timeline for Real ID Implementation is as follows:

Security Upgrades – Phase I (by December 31, 2009)
States will:
● Verify lawful status with DHS to prevent illegal aliens from obtaining REAL IDs
● Check Social Security number electronically with the Social Security Administration, so that one else can claim your identity.
● Ensure than application does not have licenses in multiple identities
● Conduct background checks for DMV/contractor employees to ensure licenses are not issued by corrupt insiders

Security Upgrades – Phase II (by May 11, 2011)
States will:
● Verify electronically all identity document with the issuing source to ensure reconrds exist and are accurate
● Confirm tamper resistant features of REAL ID licenses
● Record in DMV databases the full name established by the required identity documents
● Commence issuing REAL IDs (if not sooner)

Enrollment – Age 50 and Under (by December 1, 2014)
● All license holders born on or after December 1, 1964 who want a REAL ID-compliant license have one by December 1, 2014

Enrollment – Over Age 50 (by December 1, 2017)
● All license holders – regardless of age – who want a REAL ID- compliant license have one by December 1, 2017

Under these new standards, individuals seeking driver's licenses must provide their state Department of Public Safety office with documents proving who they are and that they're here legally. States must verify that the documents presented are legitimate, secure their own license issuing offices from identity theft and work together to prevent individuals from receiving driver's licenses from multiple states.

Additionally, the DHS is providing $360 million to the states to defray the implementation costs (this is composed of $80 million in REAL ID grants and $280 million in homeland security funding).

This is not to say that there isn’t a loud and vocal group of people and states (18 states) that oppose the implementation of the Real ID Act. Among the concerns is the fear that the Real IDs will lead to a National Identity Card. Additionally, opponents argue that privacy of citizens will be violated by the creation of this more secure ID card. From what I know and understand, the standards being proposed by this Act are an extension of the Drivers License Standards as previously established by the American Motor Vehicles Administrators Association (AAMVA) that as late as 2004 was revising the menu of security features from which states could choose in an effort to reduce counterfeiting of this form of ID (there are details included on this page). Thus, the Real ID Act retains the flexibility of each state to issue their own cards, but to conform with a standard so that each state’s license contains minimum common elements. Still, the issue has been raised as one of states rights.

Under the proposed rules all current driver's license and state I.D. holders would have to track down verified copies of "breeder documents" that prove their citizenship and marital status.
Many states are balking at the proposal, seeing it as a federal encroachment on state sovereignty, a privacy-invasive initiative and a financial strain on cash-strapped states.

So, to the opposition. Montana governor Brian Schweitzer has announced that his state will not comply with the requirement to apply for the extension as provided for in the “Final Rule” and is calling upon the governors of 17 other states to also not comply with the new regulations. The extension:

DHS understands that the States are concerned about the tight timeline required to comply with the REAL ID Act. The Secretary and other DHS officials have discussed this matter with various Governors. Since DHS wants all States to be able to comply with the Act, DHS has set-up a procedure in the NPRM for States to obtain extensions until December 31, 2009. DHS expects States that have been granted an extension to begin issuing compliant licenses no later than January 1, 2010, in most cases with a roll-out of licenses as they expire.

Schweitzer sent a letter to the governors of Colorado, Georgia, Idaho, Maine, New Hampshire, Oklahoma, South Carolina, Arizona, Hawaii, Illinois, Missouri, Nebraska, Nevada, North Dakota, Pennsylvania, Tennessee, and Washington. In that letter, he wrote:

"Today, I am asking you to join with me in resisting the DHS coercion to comply with the provisions of REAL ID, " Schweitzer wrote. "If we stand together either DHS will blink or Congress will have to act to avoid havoc at our nation's airports and federal courthouses."

In response, Homeland Security spokeswoman Laura Keehner says DHS has no intention of blinking, and says that non-compliance "will mean real consequences for their citizens starting in may if their leadership chooses not to comply" and "That includes getting on an airplane or entering a federal building, so they will need to get passports."

At the same time, the Western Hemisphere Travel Initiative is going to be only partially implemented, with a valid U.S. Passport to be required after January 31, 2008 to travel by air between the United States and Canada, Mexico, Bermuda, and the Caribbean region are required to present a passport or other valid travel document to enter or re-enter the United States.

I’m not going to get into all of the details and controversy surrounding the WHTI, but here are the key documents:

Some people see the coming of Big Brother, and all I see is another step toward ensuring our Nation’s security. Beyond this, even those who are concerned about security, specifically myself and my colleague, Mike Tanji had a series of emails over the last 24 hours discussing this very topic. Once he and I have agreed, I’ll add the email thread to this post.

Notes

3 Comments

Normally, I'm in agreement with your positions on things, Jay, but I think you're doing this topic a dis-service by misrepresenting the opposition view so badly. The need for improved ID is valid. The RealID solution, however, is a poor one with many problems. I'll have to point to my own post on the subject for a few links to why this is the case:http://idolator.typepad.com/intelfusion/2008/01/montana-governo.html

While I like the new ThreatsWatch format, the "Share Feedback" mechanism is still not the best way to have an exchange of ideas.

On this issue, a number of people disagree with me. Fact is that the AAMVA standards were moving in the same direction until Real ID came into being.

Best solution? Maybe yes, maybe no. But there is a real need for a machine readable, verifiable document with common features. Simple logic calls for it to be the drivers license. Does that make the drivers license the de facto national ID? Maybe. I must be missing something because I don't see it as an issue.

Further, and more difficult, there is a real need to verify that the documents used to secure a drivers license, regardless of Real ID, are authentic. Present a bogus birth certificate to a DMV and get a valid drivers license.

As I was writing the post, “The Need for Secure Identification,” I received an email from Michael Tanji, one of my ThreatsWatch colleagues. It started simply, with the word, “Thoughts?” It is clear that the subject is controversial and both sides have strongly held positions. What is interesting is the ways in which our two positions are different.

JF to MT
Drivers' licenses are a cost element for the states. The mandated pass throughs resulting from the Real ID Act have been the primary objection from the outset. But that seems to have been covered in the new rules. States not complying with the rules will put their citizens at a disadvantage. Let the FAA and TSA put the travel rules into place, and see how hard it gets for a Montana resident to get on a plane (even for domestic travel). Related, is the delay of the Western Hemisphere Travel Initiative. IMO, it is a regrettable hole in security.

My fear is that if the next Administration will forego implementation of a secure ID initiative. The extension of the rules and implementation of the Real ID Act is a serious concern of mine. My wife and I just applied for our passports to avoid any questions for us when we travel.

MT to JF
The cost issue is certainly a problem, and it won't be the last unfunded mandate in history, but if I'm not mistaken, the 9/11 hijackers all had valid ID. I just read where the police busted up yet another ID-selling ring, this time in DC. What good is a "real" ID in such cases?

JF to MT
One of the purposes of the Real ID Act is to ensure that the breeder documents presented to obtain a drivers license are real and authentic. Such things do not happen overnight, but change is needed. One of the things that hung Governor Spitzer out on the line in NY with his plan to issue drivers licenses to illegal aliens was the inability to prove the authenticity of the documents presented to the local DMVs when people applied for a NYS drivers license.

Document security in this country is a shambles. Frankly, one of the other things that needs to be considered is a waiting period for foreigners who want to enter this country. During that time, you are vetted and all of the security checking is done. People in this country won't stand for it (and fight the Real ID implementation), and yet, will scream loud and long when (or if) there is another attack...especially if fraudulent documents are used.

MT to JF
And I think that is the rub that is irritating so many. Line up 100 citizens and 75 of them have held their license for decades. Their freedom of movement is as given as breathing and now they're suspect? Politically it is as obtuse a move as DHS could have made. There are any number of different ways they could have played this to make it more palatable and consequently avoid the mayhem that is about to ensue.

To me it is indicative that we have no serious HLS strategy, just bad tactics. The border is still open, illegal catch-and-release continues, most DHS technical solutions are delayed or broken and leadership positions are still unfilled, but they're going to man the barricades over Real ID…amazing.

JF to MT
I agree with all of the things that you list, and yet, I favor strict implementation of Real ID as one of the only notions that make sense in protecting us from people presenting themselves fraudulently. It has nothing to do with people having held their licenses for decades. When you move to a new state, as I did, you are forced to relinquish the one from your old state as you receive your new license.

As for those who have held their drivers' licenses for decades, they can and will still hold them. The license itself will change, perhaps ever so slightly. I don’t think that anyone is making them suspect. The objective is consistency between states, and some degree of uniformity over all. If we believe that there are people among us who would do us harm (domestically based terror cells), then maintaining information on all who carry a Real ID makes sense. The staggered grandfather clause is now what we have with people under/over 50 having different deadlines.

I find it odd in a way that you and I are debating this when it is you who is the security professional, and I, the security entrepreneur.

MT to JF
And to be clear, I agree with the need for a secure identification mechanism, but having watched so many ham-handed security (homeland and national) efforts fall flat, I just cannot fathom why the gov't continues to flail about so badly. If this were an entitlement program there would be all sorts of smoke and mirrors used to get people to believe it was a good thing, but for national security they can't pull it together.

JF
My final word, reserved. I agree that DHS is a problematic agency, and that our homeland security strategies have been inconsistent. However, and it is clearly only my opinion, a truly secure and tamper proof ID is one element of a longer-term strategy for the country. One other thing. At its core, it is the immigration policy of this country that is the root of the issue. The inability to control those who enter, leads to a need to create a secure ID (call it Real ID perhaps) that ensures that only those who have entered the country legally actually hold one. No doubt that this subject is controversial and multi-faceted.